idmap_config.c revision 1fcced4c370617db71610fecffd5451a5894ca5e
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
/*
* Config routines common to idmap(1M) and idmapd(1M)
*/
#include <stdlib.h>
#include <strings.h>
#include <libintl.h>
#include <ctype.h>
#include <errno.h>
#include "idmapd.h"
#include <stdio.h>
#include <stdarg.h>
#include <pthread.h>
#include <port.h>
#include <sys/u8_textprep.h>
#include "addisc.h"
#define CONFIG_PG "config"
#define GENERAL_PG "general"
#define RECONFIGURE 1
#define POKE_AUTO_DISCOVERY 2
/*LINTLIBRARY*/
static pthread_t update_thread_handle = 0;
static int idmapd_ev_port = -1;
static int rt_sock = -1;
static int
generate_machine_sid(char **machine_sid)
{
char *p;
/*
* Generate and split 128-bit UUID into three 32-bit RIDs The
* machine_sid will be of the form S-1-5-21-N1-N2-N3 (that's
* four RIDs altogether).
*
* Technically we could use upto 14 random RIDs here, but it
* turns out that with some versions of Windows using SIDs with
* more than five RIDs in security descriptors causes problems.
*/
if (*machine_sid == NULL) {
return (-1);
}
uuid_clear(uu);
#if UUID_LEN != 16
#endif
for (i = 0; i < 3; i++) {
j = i * 4;
p += rlen;
}
return (0);
}
/* In the case of error, exists is set to FALSE anyway */
static int
{
scf_strerror(scf_error()));
return (-1);
}
scf_strerror(scf_error()));
return (-1);
}
return (0);
}
/* Check if in the case of failure the original value of *val is preserved */
static int
{
int rc = 0;
switch (type) {
case SCF_TYPE_BOOLEAN:
break;
case SCF_TYPE_COUNT:
break;
case SCF_TYPE_INTEGER:
break;
default:
type);
abort();
}
scf_strerror(scf_error()));
return (-1);
}
scf_strerror(scf_error()));
return (-1);
}
/* this is OK: the property is just undefined */
goto destruction;
/* It is still OK when a property doesn't have any value */
goto destruction;
switch (type) {
case SCF_TYPE_BOOLEAN:
break;
case SCF_TYPE_COUNT:
break;
case SCF_TYPE_INTEGER:
break;
}
return (rc);
}
static char *
{
int rc = -1;
char buf_size = 127;
int length;
for (;;) {
if (length < 0) {
rc = -1;
goto destruction;
}
buf_size *= 2;
if (!buf) {
rc = -1;
goto destruction;
}
} else {
rc = 0;
break;
}
}
if (rc < 0) {
if (buf)
}
return (buf);
}
static int
{
int len, i;
int count = 0;
int rc = -1;
scf_strerror(scf_error()));
return (-1);
}
scf_strerror(scf_error()));
return (-1);
}
scf_strerror(scf_error()));
return (-1);
}
/* this is OK: the property is just undefined */
rc = 0;
goto destruction;
}
"scf_iter_property_values(%s) failed: %s",
goto destruction;
}
/* Workaround scf bugs -- can't reset an iteration */
if (count == 0) {
count++;
if (count == 0) {
/* no values */
rc = 0;
goto destruction;
}
goto restart;
}
goto destruction;
}
i = 0;
goto destruction;
}
*portstr++ = '\0';
(char **)NULL, 10);
}
/* Ignore this server if the hostname is too long */
i++;
}
rc = 0;
if (rc < 0) {
if (servers)
}
return (rc);
}
static int
{
int rc = 0;
scf_strerror(scf_error()));
return (-1);
}
scf_strerror(scf_error()));
return (-1);
}
/* this is OK: the property is just undefined */
goto destruction;
"scf_property_get_value(%s) failed: %s",
rc = -1;
goto destruction;
}
rc = -1;
if (rc < 0) {
if (*val)
}
return (rc);
}
static int
{
int rc = -1;
int ret = -2;
int i;
goto destruction;
}
"scf_transaction_start(%s) failed: %s",
goto destruction;
}
SCF_TYPE_ASTRING) < 0) {
"scf_transaction_property_new() failed: %s",
scf_strerror(scf_error()));
goto destruction;
}
"scf_value_set_astring() failed: %s",
scf_strerror(scf_error()));
goto destruction;
}
"scf_entry_add_value() failed: %s",
scf_strerror(scf_error()));
goto destruction;
}
break;
/*
* Property group set in scf_transaction_start()
* is not the most recent. Update pg, reset tx and
* retry tx.
*/
"scf_transaction_commit(%s) failed - Retry: %s",
"scf_pg_update() failed: %s",
scf_strerror(scf_error()));
goto destruction;
}
}
}
if (ret == 1)
rc = 0;
else if (ret != -2)
"scf_transaction_commit(%s) failed: %s",
return (rc);
}
/*
* This function updates a boolean value.
* If nothing has changed it returns 0 else 1
*/
static int
{
return (0);
return (1);
}
/*
* This function updates a string value.
* If nothing has changed it returns 0 else 1
*/
static int
{
return (0);
return (0);
}
return (1);
}
/*
* This function updates a directory service structure.
* If nothing has changed it returns 0 else 1
*/
static int
{
int i;
/* Nothing to do */
return (0);
return (0);
}
/* We're unsetting this DS property */
return (1);
}
/* List all the new DSs */
return (1);
}
/*
* This function updates a trusted domains structure.
* If nothing has changed it returns 0 else 1
*/
static int
{
int i;
/* Nothing to do */
return (0);
return (0);
}
/* We're unsetting this DS property */
return (1);
}
/* List all the new domains */
return (1);
}
/*
* This function updates a domains in a forest structure.
* If nothing has changed it returns 0 else 1
*/
static int
{
int i;
/* Nothing to do */
return (0);
return (0);
}
/* We're unsetting this DS property */
return (1);
}
/* List all the new domains */
return (1);
}
static void
{
int i;
for (i = 0; i < *num_values; i++) {
}
*num_values = 0;
}
static int
{
int i, j;
int num_df1 = 0;
int num_df2 = 0;
num_df1++;
num_df2++;
return (1);
break;
}
}
if (!match)
return (1);
}
}
return (0);
}
/*
* This function updates trusted forest structure.
* If nothing has changed it returns 0 else 1
*/
static int
{
int i, j;
/* Nothing to do */
return (0);
goto not_equal;
for (i = 0; i < *num_value; i++) {
for (j = 0; j < *num_new; j++) {
(*new)[j].forest_name) == 0 &&
(*value)[i].global_catalog,
(*new)[j].global_catalog) == 0 &&
(*value)[i].domains_in_forest,
(*new)[j].domains_in_forest) == 0) {
break;
}
}
if (!match)
goto not_equal;
}
return (0);
}
*num_new = 0;
/* We're unsetting this DS property */
return (1);
}
/* List all the trusted forests */
for (i = 0; i < *num_value; i++) {
j++) {
/* List trusted Domains in the forest. */
}
/* List the hosts */
}
return (1);
}
/*
* Returns 1 if the PF_ROUTE socket event indicates that we should rescan the
* interfaces.
*
* Shamelessly based on smb_nics_changed() and other PF_ROUTE uses in ON.
*/
static
int
{
int nbytes;
int is_interesting = FALSE;
for (;;) {
break;
continue;
continue;
case RTM_NEWADDR:
case RTM_DELADDR:
case RTM_IFINFO:
break;
default:
break;
}
}
return (is_interesting);
}
/*
* Returns 1 if SIGHUP has been received (see hup_handler() elsewhere) or if an
* interface address was added or removed; otherwise it returns 0.
*
* Note that port_get() does not update its timeout argument when EINTR, unlike
* nanosleep(). We probably don't care very much here, but if we did care then
* we could always use a timer event and associate it with the same event port,
* then we could get accurate waiting regardless of EINTRs.
*/
static
int
{
switch (errno) {
case EINTR:
goto retry;
case ETIME:
/* Timeout */
return (FALSE);
default:
/* EBADF, EBADFD, EFAULT, EINVAL (end of time?)? */
exit(1);
/* NOTREACHED */
break;
}
}
/* PF_ROUTE socket read event, re-associate fd, handle event */
"routing socket with the event port: %s",
exit(1);
}
/*
* The network configuration may still be in flux. No matter,
* the resolver will re-transmit and timout if need be.
*/
return (pfroute_event_is_interesting(rt_sock));
}
int rc;
/*
* Blow away the ccache, we might have re-joined the
* domain or joined a new one
*/
/* HUP is the refresh method, so re-read SMF config */
if (rc < -1) {
"SMF properties");
exit(1);
} else if (rc == -1) {
"re-loading configuration may cause AD lookups "
"to fail");
}
return (FALSE);
}
return (FALSE);
}
void *
idmap_cfg_update_thread(void *arg)
{
poke_is_interesting = 1;
/*
* If ttl < 0 then we can wait for an event without timing out.
* If idmapd needs to notice that the system has been joined to
* a Windows domain then idmapd needs to be refreshed.
*/
if (ttl > MAX_CHECK_TIME)
/*
* If there are no interesting events, and this is not the first
* time through the loop, and we haven't waited the most that
* we're willing to wait, so do nothing but wait some more.
*/
continue;
(void) ad_disc_SubnetChanged(ad_ctx);
"SMF properties");
exit(1);
}
poke_is_interesting = 1;
else
poke_is_interesting = 0;
}
/*NOTREACHED*/
return (NULL);
}
int
idmap_cfg_start_updates(void)
{
if ((idmapd_ev_port = port_create()) < 0) {
return (-1);
}
(void) close(idmapd_ev_port);
return (-1);
}
(void) close(idmapd_ev_port);
return (-1);
}
(void) close(idmapd_ev_port);
return (-1);
}
idmap_cfg_update_thread, NULL)) != 0) {
(void) close(idmapd_ev_port);
return (-1);
}
return (0);
}
/*
* Reject attribute names with invalid characters.
*/
static
int
valid_ldap_attr(const char *attr) {
return (0);
}
return (1);
}
/*
* This is the half of idmap_cfg_load() that loads property values from
* SMF (using the config/ property group of the idmap FMRI).
*
* Return values: 0 -> success, -1 -> failure, -2 -> hard failures
* -3 -> hard smf config failures
* reading from SMF.
*/
static
int
int *errors)
{
int rc;
scf_strerror(scf_error()));
return (-2);
}
scf_strerror(scf_error()));
return (-2);
}
if (rc != 0)
errors++;
if (!_idmapdstate.debug_mode) {
} else {
idmap_log_stderr(-1);
}
}
if (rc != 0)
errors++;
if (rc != 0)
errors++;
&pgcfg->domain_name);
if (rc != 0)
errors++;
else {
pgcfg->domain_name);
}
&pgcfg->default_domain);
if (rc != 0) {
/*
* SCF failures fetching config/default_domain we treat
* as fatal as they may leave ID mapping rules that
* match unqualified winnames flapping in the wind.
*/
return (-2);
}
if (rc != 0)
errors++;
/*
* We treat default_domain as having been specified in SMF IFF
* either (the config/default_domain property was set) or (the
* old, obsolete, never documented config/mapping_domain
* property was set and the new config/domain_name property was
* not set).
*/
"Ignoring obsolete, undocumented "
"config/mapping_domain property");
}
"The config/mapping_domain property is "
"obsolete; support for it will be removed, "
"please use config/default_domain instead");
}
}
if (rc != 0)
errors++;
/* If machine_sid not configured, generate one */
return (-2);
pgcfg->machine_sid);
if (rc != 0)
errors++;
}
if (rc != 0)
errors++;
else {
}
if (rc != 0)
errors++;
else {
pgcfg->forest_name);
}
if (rc != 0)
errors++;
else
&pgcfg->global_catalog);
if (rc != 0)
errors++;
else {
}
/*
* Read directory-based name mappings related SMF properties
*/
if (rc != 0)
return (-2);
if (!bool_val)
return (rc);
if (rc != 0)
return (-2);
return (-3);
}
if (rc != 0)
return (-2);
return (-3);
}
if (rc != 0)
return (-2);
return (-3);
}
"If config/ds_name_mapping_enabled property is set to "
"true then atleast one of the following name mapping "
"attributes must be specified. (config/ad_unixuser_attr OR "
return (-3);
}
return (rc);
}
/*
* This is the half of idmap_cfg_load() that auto-discovers values of
* discoverable properties that weren't already set via SMF properties.
*
* idmap_cfg_discover() is called *after* idmap_cfg_load_smf(), so it
* needs to be careful not to overwrite any properties set in SMF.
*/
static
void
{
int i, j, k, l;
char *forestname;
int num_trusteddomains;
char *trusteddomain;
NULL);
/*
* We have trusted domains. We need to go through every
* one and find its forest. If it is a new forest we then need
* to find its Global Catalog and the domains in the forest
*/
continue;
num_trusteddomains = i;
sizeof (idmap_trustedforest_t));
j = 0;
trusted_ctx = ad_disc_init();
if (forestname == NULL) {
"Forest Name for the trusted domain %s",
continue;
}
/*
* Ignore the domain as it is part of
* the primary forest
*/
continue;
}
/* Is this a new forest? */
new_forest = B_TRUE;
for (k = 0; k < j; k++) {
if (strcasecmp(forestname,
trustedforests[k].forest_name) == 0) {
break;
}
}
if (!new_forest) {
/* Mark the domain as trusted */
for (l = 0;
if (domain_eq(trusteddomain,
domainsinforest[l].domain)) {
domainsinforest[l].trusted =
TRUE;
break;
}
}
continue;
}
/*
* Get the Global Catalog and the domains in
* this new forest.
*/
if (globalcatalog == NULL) {
"unable to discover Global "
"Catalog for the trusted domain %s",
continue;
}
NULL);
if (domainsinforest == NULL) {
"unable to discover Domains in the Forest "
"for the trusted domain %s",
continue;
}
j++;
/* Mark the domain as trusted */
l++) {
if (domain_eq(trusteddomain,
domainsinforest[l].domain)) {
break;
}
}
}
if (j > 0) {
pgcfg->num_trusted_forests = j;
} else {
}
}
"unable to discover Domains in the Forest");
}
/*
* idmap_cfg_load() is called at startup, and periodically via the
* update thread when the auto-discovery TTLs expire, as well as part of
* the refresh method, to update the current configuration. It always
* reads from SMF, but you still have to refresh the service after
* changing the config pg in order for the changes to take effect.
*
* There are two flags:
*
* - CFG_DISCOVER
* - CFG_LOG
*
* If CFG_DISCOVER is set then idmap_cfg_load() calls
* idmap_cfg_discover() to discover, via DNS and LDAP lookups, property
* values that weren't set in SMF.
*
* If CFG_LOG is set then idmap_cfg_load() will log (to LOG_NOTICE)
* whether the configuration changed. This should be used only from the
* refresh method.
*
* Return values: 0 -> success, -1 -> failure, -2 -> hard failures
* reading from SMF.
*/
int
{
int rc = 0;
int errors = 0;
int changed = 0;
int ad_reload_required = 0;
goto err;
if (flags & CFG_DISCOVER)
}
/* Non-discoverable props updated here */
/* Props that can be discovered and set in SMF updated here */
if (!live_pgcfg->dflt_dom_set_in_smf)
changed++;
}
changed++;
}
changed++;
}
changed++;
}
if (ad_reload_required)
reload_ad();
/*
* If the config changes as a result of a refresh of the
* service, then logging about it can provide useful
* feedback to the sysadmin.
*/
}
err:
if (rc < -1)
return (rc);
return ((errors == 0) ? 0 : -1);
}
/*
* Initialize 'cfg'.
*/
{
/* First the smf repository handles: */
if (!cfg) {
return (NULL);
}
scf_strerror(scf_error()));
goto error;
}
scf_strerror(scf_error()));
goto error;
}
scf_strerror(scf_error()));
goto error;
}
NULL, /* scope */
NULL, /* prop */
SCF_DECODE_FMRI_EXACT) < 0) {
scf_strerror(scf_error()));
goto error;
}
scf_strerror(scf_error()));
goto error;
}
/* Initialize AD Auto Discovery context */
goto error;
return (cfg);
(void) idmap_cfg_fini(cfg);
return (NULL);
}
void
{
if (pgcfg->default_domain) {
}
if (pgcfg->domain_name) {
}
if (pgcfg->machine_sid) {
}
if (pgcfg->domain_controller) {
}
if (pgcfg->forest_name) {
}
}
if (pgcfg->global_catalog) {
}
if (pgcfg->trusted_domains) {
}
if (pgcfg->trusted_forests)
if (pgcfg->ad_unixuser_attr) {
}
if (pgcfg->ad_unixgroup_attr) {
}
if (pgcfg->nldap_winname_attr) {
}
}
int
{
return (0);
}
void
idmap_cfg_poke_updates(void)
{
if (idmapd_ev_port != -1)
}
/*ARGSUSED*/
void
idmap_cfg_hup_handler(int sig)
{
if (idmapd_ev_port >= 0)
}